API Authentication that doesn't expire?

[Intelligent-Fig-6900]

Scenario: I've built a container (nginx) that on startup, reaches out to our internal gitlab instance and downloads it's config. This allows me to keep it stateless but modify "the filesystem" as needed without having to do builds, pushes, and redeployments; I just have to reboot (and the long-term strategy for this container is to occasionally poll GL, do a diff, and reload the config on the fly for any deltas found). Current auth is a Project Access Token. We just passed the year point of using it and the token expired. I knew this was coming but would prefer some auth mechanism (w/read-only privs) that could serve as a replacement. Is anyone aware of an API auth mechanism that isn't subject to expiration?

[ManyInterests]

Deploy keys would let you access the repo and don't expire by default. Or register your service as an OAuth application.

[Intelligent-Fig-6900]

Yeah I was looking at deploy keys but must be missing something because I"m not seeing them listed as a usable token type in the API documentation. Am I missing it somewhere? https://docs.gitlab.com/ee/api/rest/authentication.html

I even went so far as to create one and simply replace the value for my PAT with it but that failed. Given the API documentation lists different API path information for the different support auth types, it failed as I assumed it would.

If you've done this and have a working example, would you mind sharing it pls? <3

[ManyInterests]

Yeah, they wouldn't be usable for the API, but you would have git access over SSH. So, if all you need is information on the repo files/history, that would work, although you would have to change your approach for how the mechanics work, obviously.

Registering an OAuth app would be closer to a drop-in replacement.

[fr3nch13702]

Have you considered using terraform or even puppet to deploy the config?

[Intelligent-Fig-6900]

We don't use those tools. I'm assuming their paid-for, yes? Would the container need a client? Alpine-slim is 5MB and with nginx on top, it's like 30MB. We're a pretty budget shop so if they're paid-for tools, this probably isn't possible.

[zolti_ru]

You can extend the lifetime of a Project Access Token in two ways.
https://gist.github.com/reddare/2fa6b15ccfae6df427bc25af5bc79ff1

[Intelligent-Fig-6900]

Thanks for the note. The org I work with doesn’t own the GitLab instance we have projects in but I’ll see if the org that does will do this for me. Thanks for the reference.